search

mandiant / flare-fakenet-ng

FakeNet-NG - Next Generation Dynamic Network Analysis Tool
Apache License 2.0
1.78k stars 358 forks source link

get_dns_servers() in winutil.py has a bug when there are multiple DNS nameservers #147

Open Jeff17Robbins opened 3 years ago

Jeff17Robbins commented 3 years ago

This code is wrong:

https://github.com/fireeye/flare-fakenet-ng/blob/596bb139b59eb15323510ed41e33661a40c8d80c/fakenet/diverters/winutil.py#L1102

Since the .Next field is a pointer, it needs to be dereferenced. Given the structure of the while loop, the correct code is:

ip_addr_string = ip_addr_string.Next.contents if ip_addr_string.Next else None

The bug probably hasn't been noticed if the code was tested on a machine with only one DNS nameserver IP address. If your machine has 2 or more DNS nameserver IP addresses, the code crashes on the 2nd time through the loop.